SaTC: CORE: Small: Information Disclosure and Security Policy Design: A Large-Scale Randomization Experiment in Trans-Pacific Region

随着数据泄露和网络安全事件的日益突出，网络安全正成为每个人和社会面临的严重问题。此类安全事件的部分原因是政府相关政策的缺失和信息资产管理机构的安全保护不足。调查人员将设计一个独立的跨太平洋网络安全评估机构，衡量和报告各组织的安全弱点。拟议的机构旨在有效地激励组织实现理想的网络安全水平。采用严格设计的选择性现场实验，对跨太平洋地区组织的性能进行实证评估，以了解他们如何应对恶意网络犯罪（包括垃圾邮件、网络钓鱼和分布式拒绝服务（DDoS）攻击）的多样化安全性能报告。根据实验结果，该项目将为政策制定者和公司提供切实可行的建议，以改善他们的安全准备。作为数据分析的方法，研究人员将采用潜在有用的理论和经验模型：(i)允许内生实验的模型，（ii）防御者和攻击者之间具有战略交互的静态和动态模型，以及（iii）利用pi综合安全评估指标的网络保险和再保险模型。pi将利用实验和观测数据估计这些模型中与政策相关的参数。除了防御者的现有数据集之外，已经收集并将用于攻击者数据分析的重要数据集，例如网络钓鱼活动数据，外发垃圾邮件和实时DDoS信息。由于pi试图恢复政策的灵活异质效应，因为网络安全数据通常表现出大量的异质性，因此他们引入了最近计量经济学文献中开发的半参数识别和估计方法。本工作在以下几个方面对随机场实验的文献做出了贡献：(i)确定由于外部影响的存在而导致随机场实验中的内生性问题；（ii）在网络安全背景下，重新设计先前的实验，并通过引入使用攻击者的新数据集控制内生性的经验策略；（iii）完全恢复治疗的异质性效果，这与文献中通常采用的简单和有限的方法不同；（iv）由于部分数据集频率较高（例如DDoS实时攻击），开发处理大数据问题的估计方法。本项目的理论模型为网络安全文献做出了以下新贡献：(i)利用随机分析在连续时间框架下构建动态网络安全博弈；（ii）具有再保险机会的网络保险模型，明确政府作为最终过度风险承担者的角色，以及政府通过改变保费来控制组织网络安全投资水平的方法。

With more prominent data breaches and cybersecurity incidents, cyber insecurity is becoming a serious problem for every individual and the society. Such security incidents are partially due to the lack of relevant governmental polices and the insufficient security protection by organizations managing information assets. The investigators will design an independent Trans-Pacific cybersecurity evaluation institution that measures and reports organizations' security weaknesses. The proposed institution aims at effectively motivating organizations to achieve a desirable level of cybersecurity. An opt-in field experiment with a rigorous design will be employed to empirically evaluate the performance of organizations in the Trans-Pacific region to see how they will respond to the diversified security performance reports of malicious cybercrimes, including spam, phishing, and distributed denial of service (DDoS) attacks. Based on the experimental results, the project will provide practical and credible suggestions to policy makers and companies improve their security preparedness.As methods of data analyses, the researchers will employ potentially useful theoretical and empirical models: (i) a model that allows endogenous experiments, (ii) static and dynamic models with strategic interaction between defenders and attackers, and (iii) a cyber-insurance and reinsurance model which utilizes the PIs' comprehensive security evaluation metric. The PIs will estimate the policy relevant parameters in these models using both experimental and observational data. In addition to the existing dataset on defenders, important data sets that have been collected and will be used in the analyses of the data for attackers, such as data for phishing activity, outgoing spam mails, and real time DDoS information. Since the PIs seek to recover flexible heterogeneous effects of policies, as cybersecurity data typically exhibit a great deal of heterogeneity, they introduce semi-parametric identification and estimation methods developed in the recent econometrics literature. This work contributes to the literature on randomized field experiments in several ways: (i) to identify the problem of endogeneity in randomized field experiments due to the existence of external impact; (ii) in the context of cybersecurity, to redesign a previous experiment and by introducing empirical strategies that control for endogeneity using novel datasets on the attackers; (iii) to recover fully heterogeneous effects of treatments, which departs from a simple and restricted approach commonly taken in the literature; (iv) as some of the datasets are of high frequency (e.g., DDoS real time attack), to develop estimation methods that deal with big data issues. Theoretical models of this project contribute to cybersecurity literature by following novel features: (i) a dynamic cybersecurity game in the continuous-time framework by using stochastic analysis; (ii) a cyber-insurance model with reinsurance opportunity, and specification of the role of governments as the ultimate excessive risk taker, and a method for governments to control organization's cybersecurity investment level by altering the premium.